We received the following from our keylogger. Please submit to us the number
of times the editor default in sudoers is set, followed by that field's final
value, followed by the number of shells invoked, followed by the state of the
machine.
ssh user@1337box
cronjobscronjobscronjobscronjobs
ksu -l
ub3rstongdeemonsfromtehsewarsZZZ!
cd
screen
S ctmux
% tmux
%emacs --daemon
EDITOR="emacsclient -nw"
teco
EB/etc/sudoersPSeditor0TTEXo
EDITOR=vim visudo
:%s/emacs/vim, /g
:wq
&y Qvisudo
oln -s /sbin/poweroff exec
ed /etc/sudoers
oOBOBOBOBOBOBOBOBOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOC[3~[3~[3~[3~[3~[3~[3~tecoo9s/emacs/ed
%l
w /etc/sudoers
q
o&yky./exec